# Install Trident CLI
cargo -weight: 500;">install trident-cli # Initialize in your Anchor project
cd my-anchor-program
trident init
# Install Trident CLI
cargo -weight: 500;">install trident-cli # Initialize in your Anchor project
cd my-anchor-program
trident init
# Install Trident CLI
cargo -weight: 500;">install trident-cli # Initialize in your Anchor project
cd my-anchor-program
trident init
// trident-tests/fuzz_tests/fuzz_0/test_fuzz.rs
use trident_client::fuzzing::*;
use my_program::state::*;
use my_program::instructions::*; #[derive(Arbitrary, Debug)]
pub struct DepositAndBorrowData { pub deposit_amount: u64, pub borrow_amount: u64, pub intermediate_cpi: bool,
} impl FuzzInstruction for DepositAndBorrowData { fn check( &self, pre_state: &AccountSnapshot, post_state: &AccountSnapshot, _accounts: &FuzzAccounts, ) -> Result<()> { let collateral = post_state.get_account::<VaultAccount>("vault")?; let debt = post_state.get_account::<DebtAccount>("debt")?; assert!( debt.borrowed <= collateral.deposited * COLLATERAL_RATIO / 100, "INVARIANT VIOLATED: borrowed {} exceeds collateral limit {}", debt.borrowed, collateral.deposited * COLLATERAL_RATIO / 100 ); Ok(()) }
}
// trident-tests/fuzz_tests/fuzz_0/test_fuzz.rs
use trident_client::fuzzing::*;
use my_program::state::*;
use my_program::instructions::*; #[derive(Arbitrary, Debug)]
pub struct DepositAndBorrowData { pub deposit_amount: u64, pub borrow_amount: u64, pub intermediate_cpi: bool,
} impl FuzzInstruction for DepositAndBorrowData { fn check( &self, pre_state: &AccountSnapshot, post_state: &AccountSnapshot, _accounts: &FuzzAccounts, ) -> Result<()> { let collateral = post_state.get_account::<VaultAccount>("vault")?; let debt = post_state.get_account::<DebtAccount>("debt")?; assert!( debt.borrowed <= collateral.deposited * COLLATERAL_RATIO / 100, "INVARIANT VIOLATED: borrowed {} exceeds collateral limit {}", debt.borrowed, collateral.deposited * COLLATERAL_RATIO / 100 ); Ok(()) }
}
// trident-tests/fuzz_tests/fuzz_0/test_fuzz.rs
use trident_client::fuzzing::*;
use my_program::state::*;
use my_program::instructions::*; #[derive(Arbitrary, Debug)]
pub struct DepositAndBorrowData { pub deposit_amount: u64, pub borrow_amount: u64, pub intermediate_cpi: bool,
} impl FuzzInstruction for DepositAndBorrowData { fn check( &self, pre_state: &AccountSnapshot, post_state: &AccountSnapshot, _accounts: &FuzzAccounts, ) -> Result<()> { let collateral = post_state.get_account::<VaultAccount>("vault")?; let debt = post_state.get_account::<DebtAccount>("debt")?; assert!( debt.borrowed <= collateral.deposited * COLLATERAL_RATIO / 100, "INVARIANT VIOLATED: borrowed {} exceeds collateral limit {}", debt.borrowed, collateral.deposited * COLLATERAL_RATIO / 100 ); Ok(()) }
}
fn fuzz_iteration(fuzz_data: &mut FuzzData) -> Result<()> { // Attack Pattern 1: Deposit → CPI to external program → Borrow fuzz_data.execute_sequence(&[ FuzzAction::Deposit(deposit_data), FuzzAction::ExternalCPI(cpi_data), FuzzAction::Borrow(borrow_data), ])?; // Attack Pattern 2: Initialize → Close → Reinitialize fuzz_data.execute_sequence(&[ FuzzAction::Initialize(init_data), FuzzAction::CloseAccount(close_data), FuzzAction::Initialize(reinit_data), ])?; // Attack Pattern 3: Rapid deposit/withdraw cycles for _ in 0..100 { fuzz_data.execute_sequence(&[ FuzzAction::Deposit(small_amount), FuzzAction::Withdraw(small_amount), ])?; } Ok(())
}
fn fuzz_iteration(fuzz_data: &mut FuzzData) -> Result<()> { // Attack Pattern 1: Deposit → CPI to external program → Borrow fuzz_data.execute_sequence(&[ FuzzAction::Deposit(deposit_data), FuzzAction::ExternalCPI(cpi_data), FuzzAction::Borrow(borrow_data), ])?; // Attack Pattern 2: Initialize → Close → Reinitialize fuzz_data.execute_sequence(&[ FuzzAction::Initialize(init_data), FuzzAction::CloseAccount(close_data), FuzzAction::Initialize(reinit_data), ])?; // Attack Pattern 3: Rapid deposit/withdraw cycles for _ in 0..100 { fuzz_data.execute_sequence(&[ FuzzAction::Deposit(small_amount), FuzzAction::Withdraw(small_amount), ])?; } Ok(())
}
fn fuzz_iteration(fuzz_data: &mut FuzzData) -> Result<()> { // Attack Pattern 1: Deposit → CPI to external program → Borrow fuzz_data.execute_sequence(&[ FuzzAction::Deposit(deposit_data), FuzzAction::ExternalCPI(cpi_data), FuzzAction::Borrow(borrow_data), ])?; // Attack Pattern 2: Initialize → Close → Reinitialize fuzz_data.execute_sequence(&[ FuzzAction::Initialize(init_data), FuzzAction::CloseAccount(close_data), FuzzAction::Initialize(reinit_data), ])?; // Attack Pattern 3: Rapid deposit/withdraw cycles for _ in 0..100 { fuzz_data.execute_sequence(&[ FuzzAction::Deposit(small_amount), FuzzAction::Withdraw(small_amount), ])?; } Ok(())
}
trident fuzz run-hfuzz fuzz_0 -- -n 1000000 --timeout 10
trident fuzz coverage fuzz_0
trident fuzz run-hfuzz fuzz_0 -- -n 1000000 --timeout 10
trident fuzz coverage fuzz_0
trident fuzz run-hfuzz fuzz_0 -- -n 1000000 --timeout 10
trident fuzz coverage fuzz_0
name: Sec3 X-ray Scan
on: [push, pull_request] jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Sec3 X-ray Scan uses: sec3dev/x-ray-action@v2 with: project-path: programs/my-program severity-threshold: high api-key: ${{ secrets.SEC3_API_KEY }} - name: Upload SARIF if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: sec3-results.sarif
name: Sec3 X-ray Scan
on: [push, pull_request] jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Sec3 X-ray Scan uses: sec3dev/x-ray-action@v2 with: project-path: programs/my-program severity-threshold: high api-key: ${{ secrets.SEC3_API_KEY }} - name: Upload SARIF if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: sec3-results.sarif
name: Sec3 X-ray Scan
on: [push, pull_request] jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Sec3 X-ray Scan uses: sec3dev/x-ray-action@v2 with: project-path: programs/my-program severity-threshold: high api-key: ${{ secrets.SEC3_API_KEY }} - name: Upload SARIF if: always() uses: github/codeql-action/upload-sarif@v3 with: sarif_file: sec3-results.sarif
// ❌ VULNERABLE
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
} // ✅ FIXED
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut, has_one = authority)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
}
// ❌ VULNERABLE
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
} // ✅ FIXED
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut, has_one = authority)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
}
// ❌ VULNERABLE
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
} // ✅ FIXED
#[derive(Accounts)]
pub struct UpdateConfig<'info> { #[account(mut, has_one = authority)] pub config: Account<'info, Config>, pub authority: Signer<'info>,
}
// ❌ VULNERABLE — attacker can re-initialize with different authority
#[account(init_if_needed, payer = user, space = 8 + UserAccount::INIT_SPACE)]
pub user_account: Account<'info, UserAccount>,
// ❌ VULNERABLE — attacker can re-initialize with different authority
#[account(init_if_needed, payer = user, space = 8 + UserAccount::INIT_SPACE)]
pub user_account: Account<'info, UserAccount>,
// ❌ VULNERABLE — attacker can re-initialize with different authority
#[account(init_if_needed, payer = user, space = 8 + UserAccount::INIT_SPACE)]
pub user_account: Account<'info, UserAccount>,
// ❌ VULNERABLE
/// CHECK: Program to CPI into
pub target_program: UncheckedAccount<'info>, // ✅ FIXED
#[account(address = target_program::ID)]
pub target_program: Program<'info, TargetProgram>,
// ❌ VULNERABLE
/// CHECK: Program to CPI into
pub target_program: UncheckedAccount<'info>, // ✅ FIXED
#[account(address = target_program::ID)]
pub target_program: Program<'info, TargetProgram>,
// ❌ VULNERABLE
/// CHECK: Program to CPI into
pub target_program: UncheckedAccount<'info>, // ✅ FIXED
#[account(address = target_program::ID)]
pub target_program: Program<'info, TargetProgram>,
solsec audit ./programs/my-program/src/lib.rs \ --output report.json \ --severity-threshold medium
solsec audit ./programs/my-program/src/lib.rs \ --output report.json \ --severity-threshold medium
solsec audit ./programs/my-program/src/lib.rs \ --output report.json \ --severity-threshold medium
import anthropic
import json
from pathlib import Path SOLANA_AUDIT_CONTEXT = """
You are a Solana smart contract security auditor. Check for:
1. Missing signer checks on authority accounts
2. PDA seed collisions (same seeds for different logical entities)
3. Stale account reads after CPI (reload accounts after invoke())
4. Token-2022 transfer hook validation gaps
5. Incorrect remaining_accounts iteration
6. Rent-exempt assumptions on closeable accounts
7. Missing realloc checks on dynamic-size accounts
8. Integer overflow in fee calculations (even with checked_math)
9. Flash loan attack vectors on price-dependent operations
10. Cross-program invocation to unvalidated program IDs For each finding, provide:
- Severity (Critical/High/Medium/Low/Info)
- Exact line reference
- Exploit scenario
- Recommended fix with code
""" def audit_file(file_path: str) -> dict: client = anthropic.Anthropic() code = Path(file_path).read_text() response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=4096, system=SOLANA_AUDIT_CONTEXT, messages=[{"role": "user", "content": f"Audit this Solana program:\n\n```
{% endraw %}
rust\n{code}\n
{% raw %}
```"}] ) return parse_findings(response.content[0].text) if __name__ == "__main__": import sys results = audit_file(sys.argv[1]) print(json.dumps(results, indent=2)) critical = [f for f in results["findings"] if f["severity"] in ["Critical", "High"]] sys.exit(1 if critical else 0)
import anthropic
import json
from pathlib import Path SOLANA_AUDIT_CONTEXT = """
You are a Solana smart contract security auditor. Check for:
1. Missing signer checks on authority accounts
2. PDA seed collisions (same seeds for different logical entities)
3. Stale account reads after CPI (reload accounts after invoke())
4. Token-2022 transfer hook validation gaps
5. Incorrect remaining_accounts iteration
6. Rent-exempt assumptions on closeable accounts
7. Missing realloc checks on dynamic-size accounts
8. Integer overflow in fee calculations (even with checked_math)
9. Flash loan attack vectors on price-dependent operations
10. Cross-program invocation to unvalidated program IDs For each finding, provide:
- Severity (Critical/High/Medium/Low/Info)
- Exact line reference
- Exploit scenario
- Recommended fix with code
""" def audit_file(file_path: str) -> dict: client = anthropic.Anthropic() code = Path(file_path).read_text() response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=4096, system=SOLANA_AUDIT_CONTEXT, messages=[{"role": "user", "content": f"Audit this Solana program:\n\n```
{% endraw %}
rust\n{code}\n
{% raw %}
```"}] ) return parse_findings(response.content[0].text) if __name__ == "__main__": import sys results = audit_file(sys.argv[1]) print(json.dumps(results, indent=2)) critical = [f for f in results["findings"] if f["severity"] in ["Critical", "High"]] sys.exit(1 if critical else 0)
import anthropic
import json
from pathlib import Path SOLANA_AUDIT_CONTEXT = """
You are a Solana smart contract security auditor. Check for:
1. Missing signer checks on authority accounts
2. PDA seed collisions (same seeds for different logical entities)
3. Stale account reads after CPI (reload accounts after invoke())
4. Token-2022 transfer hook validation gaps
5. Incorrect remaining_accounts iteration
6. Rent-exempt assumptions on closeable accounts
7. Missing realloc checks on dynamic-size accounts
8. Integer overflow in fee calculations (even with checked_math)
9. Flash loan attack vectors on price-dependent operations
10. Cross-program invocation to unvalidated program IDs For each finding, provide:
- Severity (Critical/High/Medium/Low/Info)
- Exact line reference
- Exploit scenario
- Recommended fix with code
""" def audit_file(file_path: str) -> dict: client = anthropic.Anthropic() code = Path(file_path).read_text() response = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=4096, system=SOLANA_AUDIT_CONTEXT, messages=[{"role": "user", "content": f"Audit this Solana program:\n\n```
{% endraw %}
rust\n{code}\n
{% raw %}
```"}] ) return parse_findings(response.content[0].text) if __name__ == "__main__": import sys results = audit_file(sys.argv[1]) print(json.dumps(results, indent=2)) critical = [f for f in results["findings"] if f["severity"] in ["Critical", "High"]] sys.exit(1 if critical else 0)
name: Solana Security Pipeline
on: push: branches: [main, develop] pull_request: branches: [main] jobs: static-analysis: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Cargo Clippy run: cargo clippy -- -D warnings - name: Cargo Audit run: cargo audit - name: Sec3 X-ray uses: sec3dev/x-ray-action@v2 with: project-path: programs/ severity-threshold: high fuzz-testing: runs-on: ubuntu-latest needs: static-analysis steps: - uses: actions/checkout@v4 - name: Install Solana + Anchor run: | sh -c "$(-weight: 500;">curl -sSfL https://release.anza.xyz/stable/-weight: 500;">install)" cargo -weight: 500;">install ---weight: 500;">git https://github.com/coral-xyz/anchor anchor-cli - name: Install Trident run: cargo -weight: 500;">install trident-cli - name: Run Fuzz Tests run: trident fuzz run-hfuzz fuzz_0 -- -n 500000 --timeout 10 timeout-minutes: 10 ai-review: if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: AI Security Audit env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} run: python scripts/ai_audit.py programs/my-program/src/lib.rs security-gate: needs: [static-analysis, fuzz-testing, ai-review] if: always() runs-on: ubuntu-latest steps: - name: Check Results run: | if [ "${{ needs.static-analysis.result }}" != "success" ] || \ [ "${{ needs.fuzz-testing.result }}" != "success" ]; then echo "::error::Security pipeline failed" exit 1 fi
name: Solana Security Pipeline
on: push: branches: [main, develop] pull_request: branches: [main] jobs: static-analysis: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Cargo Clippy run: cargo clippy -- -D warnings - name: Cargo Audit run: cargo audit - name: Sec3 X-ray uses: sec3dev/x-ray-action@v2 with: project-path: programs/ severity-threshold: high fuzz-testing: runs-on: ubuntu-latest needs: static-analysis steps: - uses: actions/checkout@v4 - name: Install Solana + Anchor run: | sh -c "$(-weight: 500;">curl -sSfL https://release.anza.xyz/stable/-weight: 500;">install)" cargo -weight: 500;">install ---weight: 500;">git https://github.com/coral-xyz/anchor anchor-cli - name: Install Trident run: cargo -weight: 500;">install trident-cli - name: Run Fuzz Tests run: trident fuzz run-hfuzz fuzz_0 -- -n 500000 --timeout 10 timeout-minutes: 10 ai-review: if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: AI Security Audit env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} run: python scripts/ai_audit.py programs/my-program/src/lib.rs security-gate: needs: [static-analysis, fuzz-testing, ai-review] if: always() runs-on: ubuntu-latest steps: - name: Check Results run: | if [ "${{ needs.static-analysis.result }}" != "success" ] || \ [ "${{ needs.fuzz-testing.result }}" != "success" ]; then echo "::error::Security pipeline failed" exit 1 fi
name: Solana Security Pipeline
on: push: branches: [main, develop] pull_request: branches: [main] jobs: static-analysis: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Cargo Clippy run: cargo clippy -- -D warnings - name: Cargo Audit run: cargo audit - name: Sec3 X-ray uses: sec3dev/x-ray-action@v2 with: project-path: programs/ severity-threshold: high fuzz-testing: runs-on: ubuntu-latest needs: static-analysis steps: - uses: actions/checkout@v4 - name: Install Solana + Anchor run: | sh -c "$(-weight: 500;">curl -sSfL https://release.anza.xyz/stable/-weight: 500;">install)" cargo -weight: 500;">install ---weight: 500;">git https://github.com/coral-xyz/anchor anchor-cli - name: Install Trident run: cargo -weight: 500;">install trident-cli - name: Run Fuzz Tests run: trident fuzz run-hfuzz fuzz_0 -- -n 500000 --timeout 10 timeout-minutes: 10 ai-review: if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: AI Security Audit env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} run: python scripts/ai_audit.py programs/my-program/src/lib.rs security-gate: needs: [static-analysis, fuzz-testing, ai-review] if: always() runs-on: ubuntu-latest steps: - name: Check Results run: | if [ "${{ needs.static-analysis.result }}" != "success" ] || \ [ "${{ needs.fuzz-testing.result }}" != "success" ]; then echo "::error::Security pipeline failed" exit 1 fi - Trident — stateful fuzzing that catches logic bugs and arithmetic edge cases
- Sec3 X-ray — static analysis covering 50+ vulnerability classes
- AI audit agents (SOLSEC / Claude-based scanners) — RAG-powered review for Solana-specific anti-patterns - [ ] Install Trident: cargo -weight: 500;">install trident-cli && trident init
- [ ] Write MGF harnesses for your top 3 invariants
- [ ] Configure Sec3 X-ray GitHub Action
- [ ] Set up AI audit script with your preferred provider
- [ ] Add the unified pipeline YAML
- [ ] Set severity-threshold: high for merge blocking
- [ ] Run your first full scan and triage the findings
